Is HostGator storing my password in plaintext?
I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.
I asked a customer care representative to help me add an SSL certificate to a site I host with them. When he was done, I received this e-mail with all my login information, and my entire password in plain text (I left the first letter visible as evidence). I set up this password over a year ago, and it was a big surprise to find out they sent it back to me, unprompted, in plaintext:
I immediately brought this up to the representative, who repeatedly tried to convince me that it was OK. I decided to drop it after a few minutes, because I think I should bring it up to someone higher up. Before I do so, is it safe to assume that my password is stored in their database as plain text? If so, do you have any suggestions on how to address this issue with the provider?
passwords databases web-hosting
asked 3 hours ago
MarquizzoMarquizzo
1185
New contributor
Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
|
show 2 more comments
I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.
I asked a customer care representative to help me add an SSL certificate to a site I host with them. When he was done, I received this e-mail with all my login information, and my entire password in plain text (I left the first letter visible as evidence). I set up this password over a year ago, and it was a big surprise to find out they sent it back to me, unprompted, in plaintext:
I immediately brought this up to the representative, who repeatedly tried to convince me that it was OK. I decided to drop it after a few minutes, because I think I should bring it up to someone higher up. Before I do so, is it safe to assume that my password is stored in their database as plain text? If so, do you have any suggestions on how to address this issue with the provider?
passwords databases web-hosting
asked 3 hours ago
MarquizzoMarquizzo
1185
New contributor
Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.
– schroeder♦
3 hours ago
1
@schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.
– Marquizzo
3 hours ago
Ok, that all good info to have.
– schroeder♦
3 hours ago
It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.
– Patrick Mevzek
2 hours ago
The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.
– Future Security
2 hours ago
|
show 2 more comments
I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.
I asked a customer care representative to help me add an SSL certificate to a site I host with them. When he was done, I received this e-mail with all my login information, and my entire password in plain text (I left the first letter visible as evidence). I set up this password over a year ago, and it was a big surprise to find out they sent it back to me, unprompted, in plaintext:
I immediately brought this up to the representative, who repeatedly tried to convince me that it was OK. I decided to drop it after a few minutes, because I think I should bring it up to someone higher up. Before I do so, is it safe to assume that my password is stored in their database as plain text? If so, do you have any suggestions on how to address this issue with the provider?
passwords databases web-hosting
asked 3 hours ago
MarquizzoMarquizzo
1185
New contributor
Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.
I asked a customer care representative to help me add an SSL certificate to a site I host with them. When he was done, I received this e-mail with all my login information, and my entire password in plain text (I left the first letter visible as evidence). I set up this password over a year ago, and it was a big surprise to find out they sent it back to me, unprompted, in plaintext:
I immediately brought this up to the representative, who repeatedly tried to convince me that it was OK. I decided to drop it after a few minutes, because I think I should bring it up to someone higher up. Before I do so, is it safe to assume that my password is stored in their database as plain text? If so, do you have any suggestions on how to address this issue with the provider?
passwords databases web-hosting
passwords databases web-hosting
asked 3 hours ago
MarquizzoMarquizzo
1185
New contributor
Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 3 hours ago
MarquizzoMarquizzo
1185
New contributor
Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 3 hours ago
Marquizzo
asked 3 hours ago
MarquizzoMarquizzo
1185
New contributor
Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 3 hours ago
MarquizzoMarquizzo
1185
asked 3 hours ago
MarquizzoMarquizzo
1185
1185
New contributor
Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Marquizzo is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.
– schroeder♦
3 hours ago
1
@schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.
– Marquizzo
3 hours ago
Ok, that all good info to have.
– schroeder♦
3 hours ago
It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.
– Patrick Mevzek
2 hours ago
The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.
– Future Security
2 hours ago
|
show 2 more comments
1
Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.
– schroeder♦
3 hours ago
1
@schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.
– Marquizzo
3 hours ago
Ok, that all good info to have.
– schroeder♦
3 hours ago
It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.
– Patrick Mevzek
2 hours ago
The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.
– Future Security
2 hours ago
1
1
Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.
– schroeder♦
3 hours ago
Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.
– schroeder♦
3 hours ago
1
1
@schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.
– Marquizzo
3 hours ago
@schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.
– Marquizzo
3 hours ago
Ok, that all good info to have.
– schroeder♦
3 hours ago
Ok, that all good info to have.
– schroeder♦
3 hours ago
It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.
– Patrick Mevzek
2 hours ago
It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.
– Patrick Mevzek
2 hours ago
The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.
– Future Security
2 hours ago
The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.
– Future Security
2 hours ago
|
show 2 more comments
2 Answers
2
active
oldest
votes
Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).
Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.
Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.
answered 3 hours ago
CBHackingCBHacking
10.9k11627
That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.
– Marquizzo
2 hours ago
You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.
– psosuna
1 hour ago
add a comment |
We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.
edited 3 hours ago
schroeder♦
78k30173209
answered 3 hours ago
Jason MichaelsJason Michaels
11
New contributor
Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?
– Marquizzo
3 hours ago
@Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.
– Jason Michaels
3 hours ago
@Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?
– Jason Michaels
3 hours ago
1
@JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.
– Peteris
2 hours ago
Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.
– Jason Michaels
2 hours ago
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "162"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Marquizzo is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e) {
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom)) {
StackExchange.using('gps', function() { StackExchange.gps.track('embedded_signup_form.view', { location: 'question_page' }); });
$window.unbind('scroll', onScroll);
}
};
$window.on('scroll', onScroll);
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f206186%2fis-hostgator-storing-my-password-in-plaintext%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).
Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.
Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.
answered 3 hours ago
CBHackingCBHacking
10.9k11627
That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.
– Marquizzo
2 hours ago
You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.
– psosuna
1 hour ago
add a comment |
Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).
Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.
Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.
answered 3 hours ago
CBHackingCBHacking
10.9k11627
That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.
– Marquizzo
2 hours ago
You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.
– psosuna
1 hour ago
add a comment |
Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).
Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.
Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.
answered 3 hours ago
CBHackingCBHacking
10.9k11627
Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).
Technically, the password might be stored under reversible encryption rather than plain text, but that's nearly as bad. The absolute minimum standard should be a salted hash - anything less and anybody with access to the auth database who wants to can use an online rainbow table to get back the plaintext passwords in moments - but single-iteration secure hash algorithm (SHA) functions are still easy to brute force with a GPU (they're designed to be fast; a high-end GPU can compute billions per second) so they really ought to be using a proper password hashing function such as scrypt or argon2, or in a pinch bcrypt or PBKDF2.
Also, there is absolutely no way to guarantee that the email was encrypted along the entire path between their mail server and your email client. Email was designed in a day when people didn't really consider such things to be critical, and short of an end-to-end encryption scheme like OpenPGP or S/MIME, email is at best encrypted opportunistically, and may be passed through an unencrypted relay.
answered 3 hours ago
CBHackingCBHacking
10.9k11627
answered 3 hours ago
CBHackingCBHacking
10.9k11627
answered 3 hours ago
CBHackingCBHacking
10.9k11627
answered 3 hours ago
CBHackingCBHacking
10.9k11627
10.9k11627
That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.
– Marquizzo
2 hours ago
You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.
– psosuna
1 hour ago
add a comment |
That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.
– Marquizzo
2 hours ago
You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.
– psosuna
1 hour ago
That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.
– Marquizzo
2 hours ago
That's a very good point. Not only are they storing their passwords in a potentially insecure manner, they are also unnecessarily transmitting them to their users through an insecure protocol.
– Marquizzo
2 hours ago
You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.
– psosuna
1 hour ago
You should absolutely bring this up. No decent current security system should be able to provide current credentials. Admins should have knowledge on how to reset to a default as necessary or provide reset instructions, but not retrieve and provide you with the private credentials that you, the user, created, and should only be known by you. You can bring this up as an exposure to a malicious insider or MITM.
– psosuna
1 hour ago
add a comment |
We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.
edited 3 hours ago
schroeder♦
78k30173209
answered 3 hours ago
Jason MichaelsJason Michaels
11
New contributor
Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?
– Marquizzo
3 hours ago
@Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.
– Jason Michaels
3 hours ago
@Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?
– Jason Michaels
3 hours ago
1
@JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.
– Peteris
2 hours ago
Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.
– Jason Michaels
2 hours ago
add a comment |
We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.
edited 3 hours ago
schroeder♦
78k30173209
answered 3 hours ago
Jason MichaelsJason Michaels
11
New contributor
Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?
– Marquizzo
3 hours ago
@Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.
– Jason Michaels
3 hours ago
@Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?
– Jason Michaels
3 hours ago
1
@JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.
– Peteris
2 hours ago
Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.
– Jason Michaels
2 hours ago
add a comment |
We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.
edited 3 hours ago
schroeder♦
78k30173209
answered 3 hours ago
Jason MichaelsJason Michaels
11
New contributor
Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
We aren't HostGator, but they said they aren't. Sending it to you in an email doesn't mean it's stored in plaintext on their servers, but no one other than them can be for sure.
edited 3 hours ago
schroeder♦
78k30173209
answered 3 hours ago
Jason MichaelsJason Michaels
11
New contributor
Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 3 hours ago
schroeder♦
78k30173209
edited 3 hours ago
schroeder♦
78k30173209
edited 3 hours ago
schroeder♦
78k30173209
78k30173209
answered 3 hours ago
Jason MichaelsJason Michaels
11
New contributor
Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 3 hours ago
Jason MichaelsJason Michaels
11
answered 3 hours ago
Jason MichaelsJason Michaels
11
11
New contributor
Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Jason Michaels is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?
– Marquizzo
3 hours ago
@Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.
– Jason Michaels
3 hours ago
@Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?
– Jason Michaels
3 hours ago
1
@JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.
– Peteris
2 hours ago
Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.
– Jason Michaels
2 hours ago
add a comment |
I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?
– Marquizzo
3 hours ago
@Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.
– Jason Michaels
3 hours ago
@Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?
– Jason Michaels
3 hours ago
1
@JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.
– Peteris
2 hours ago
Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.
– Jason Michaels
2 hours ago
I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?
– Marquizzo
3 hours ago
I set up that password over a year ago. Could you explain to me how they sent it back to me in plaintext if it wasn't stored in plaintext?
– Marquizzo
3 hours ago
@Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.
– Jason Michaels
3 hours ago
@Marquizzo again, I'm not them, but I am sure if they have some encryption scheme for passwords or other way to obfuscate it they have a way to decrypt it in case you loose your password. I use Digital Ocean and they allow me to get my password back if I lose it.
– Jason Michaels
3 hours ago
@Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?
– Jason Michaels
3 hours ago
@Marquizzo, it literally says thank you for your order. Did they have to bill you again and it popped up bc of that?
– Jason Michaels
3 hours ago
1
1
@JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.
– Peteris
2 hours ago
@JasonMichaels that's kind of unusual, in general they should not be able to get your password back if you lose it, they should be only able to reset/overwrite the password with a new one.
– Peteris
2 hours ago
Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.
– Jason Michaels
2 hours ago
Lots of companies save passwords for legal reasons like if they were contacted by law enforcement or whatever, you are right that some don't believe in that though.
– Jason Michaels
2 hours ago
add a comment |
Marquizzo is a new contributor. Be nice, and check out our Code of Conduct.
Marquizzo is a new contributor. Be nice, and check out our Code of Conduct.
Marquizzo is a new contributor. Be nice, and check out our Code of Conduct.
Marquizzo is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Information Security Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e) {
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom)) {
StackExchange.using('gps', function() { StackExchange.gps.track('embedded_signup_form.view', { location: 'question_page' }); });
$window.unbind('scroll', onScroll);
}
};
$window.on('scroll', onScroll);
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f206186%2fis-hostgator-storing-my-password-in-plaintext%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e) {
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom)) {
StackExchange.using('gps', function() { StackExchange.gps.track('embedded_signup_form.view', { location: 'question_page' }); });
$window.unbind('scroll', onScroll);
}
};
$window.on('scroll', onScroll);
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e) {
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom)) {
StackExchange.using('gps', function() { StackExchange.gps.track('embedded_signup_form.view', { location: 'question_page' }); });
$window.unbind('scroll', onScroll);
}
};
$window.on('scroll', onScroll);
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e) {
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom)) {
StackExchange.using('gps', function() { StackExchange.gps.track('embedded_signup_form.view', { location: 'question_page' }); });
$window.unbind('scroll', onScroll);
}
};
$window.on('scroll', onScroll);
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Welcome emails tend to have a temporary password that is sent in plaintext. The system generates that and sends it to you. But even then, it is likely to be hashed (not encrypted) in their systems. The reason they know it is because they generated it.
– schroeder♦
3 hours ago
1
@schroeder They did not generate the password. I set it up over a year ago. This was not a "welcome e-mail", I've had an account with them for a while now. Today's chat with the representative was to ask for help with setting up an SSL certificate.
– Marquizzo
3 hours ago
Ok, that all good info to have.
– schroeder♦
3 hours ago
It can be encrypted in a database but in a way that it could be decrypted for whatever need. It is different if it was stored hashed in the database, in which case the plain text form could never be retrieved, only checking equality would be possible.
– Patrick Mevzek
2 hours ago
The opposite of encryption is decryption. Encryption converts plaintext to ciphertext. Decryption converts ciphertext to plaintext. If someone can tell you your password then it may or may not be encrypted on their end. The method which should be used, that isn't reversible (by any method other than guess and check), is called hashing.
– Future Security
2 hours ago